Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 597
Alerts This Week
Warning Icon 1 597

Ubuntu 14.10: USN-2423-1 Critical ClamAV Code Execution Threat

ubuntu
Calendar Grey November 26, 2014
Dist Ubuntu Esm H88
Exploits in ClamAV on Ubuntu may result in system failures or unauthorized code execution. Ensure your system is updated to implement the necessary patches.
ClamAV could be made to crash or run programs if it processed a specially crafted file.

Summary

ClamAV could be made to crash or run programs if it processed a specially

crafted file.

Software Description:

- clamav: Anti-virus utility for Unix

Details:

Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript

files. An attacker could possibly use this issue to cause ClamAV to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2013-6497)

Damien Millescamp discovered that ClamAV incorrectly handled certain PE

files. An attacker could possibly use this issue to cause ClamAV to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2014-9050)

Topics%20covered

Topics Covered

security advisory denial of service critical code execution Ubuntu vulnerability clamav

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  clamav                          0.98.5+dfsg-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  clamav                          0.98.5+addedllvm-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  clamav                          0.98.5+addedllvm-0ubuntu0.12.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References

https://ubuntu.com/security/notices/USN-2423-1

CVE-2013-6497, CVE-2014-9050

Severity
critical
Lowest
Low
Medium
High
Critical

November 26, 2014

Topics%20covered

Topics Covered

security advisory denial of service critical code execution Ubuntu vulnerability clamav

Package Information

https://launchpad.net/ubuntu/+source/clamav/0.98.5+dfsg-0ubuntu0.14.10.1
https://launchpad.net/ubuntu/+source/clamav/0.98.5+addedllvm-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/clamav/0.98.5+addedllvm-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.